PLUGIN SECURITY
Is WP Directory Kit safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the WP Directory Kit WordPress plugin — checked against WP Clinic's local security database.
What this plugin does
- Slug:
wpdirectorykit
Maintenance status
Known vulnerabilities
44 known CVEs on file for WP Directory Kit.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-118420 | WP Directory Kit [wpdirectorykit] < 1.6.3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 1.6.3 | 1.6.3 | 2026-11-11 | — |
| CVE-2026-118418 | WP Directory Kit [wpdirectorykit] < 1.6.3 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 1.6.3 | 1.6.3 | 2026-11-11 | — |
| CVE-2026-109197 | WP Directory Kit [wpdirectorykit] < 1.6.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 1.6.1 | 1.6.1 | 2026-10-09 | — |
| CVE-2026-96653 | WP Directory Kit [wpdirectorykit] < 1.6.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 1.6.0 | 1.6.0 | 2026-09-29 | — |
| CVE-2026-16591 | WP Directory Kit [wpdirectorykit] < 1.5.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 1.5.8 | 1.5.8 | 2026-09-26 | — |
| — | WP Directory Kit [wpdirectorykit] <= 1.6.0 (unfixed) | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 1.6.0 | 1.6.0 | 2026-09-15 | — |
| — | WP Directory Kit [wpdirectorykit] < 1.5.9 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 1.5.9 | 1.5.9 | 2026-09-15 | — |
| — | WP Directory Kit [wpdirectorykit] < 1.6.1 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 1.6.1 | 1.6.1 | 2026-09-15 | — |
+ 40 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-16596 | WP Directory Kit [wpdirectorykit] < 1.5.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 1.5.5 | 1.5.5 | 2026-09-15 | — |
| CVE-2026-16588 | WP Directory Kit [wpdirectorykit] < 1.5.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 1.5.5 | 1.5.5 | 2026-08-21 | — |
| CVE-2026-18231 | WP Directory Kit [wpdirectorykit] < 1.5.7 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 1.5.7 | 1.5.7 | 2026-08-19 | — |
| CVE-2026-18653 | WP Directory Kit [wpdirectorykit] < 1.5.7 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 1.5.7 | 1.5.7 | 2026-08-16 | — |
| CVE-2026-28001 | WP Directory Kit [wpdirectorykit] < 1.5.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.3 | < 1.5.5 | 1.5.5 | 2026-08-12 | — |
| CVE-2026-27538 | WP Directory Kit [wpdirectorykit] < 1.5.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 1.5.5 | 1.5.5 | 2026-08-11 | — |
| CVE-2026-18474 | WP Directory Kit [wpdirectorykit] < 1.5.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 1.5.6 | 1.5.6 | 2026-08-10 | — |
| CVE-2026-18230 | WP Directory Kit [wpdirectorykit] < 1.5.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 1.5.6 | 1.5.6 | 2026-08-10 | — |
| CVE-2026-16595 | WP Directory Kit [wpdirectorykit] < 1.5.5 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 1.5.5 | 1.5.5 | 2026-08-08 | — |
| CVE-2026-16594 | WP Directory Kit [wpdirectorykit] < 1.5.5 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 1.5.5 | 1.5.5 | 2026-08-08 | — |
| CVE-2026-16590 | WP Directory Kit [wpdirectorykit] < 1.5.5 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 1.5.5 | 1.5.5 | 2026-08-08 | — |
| CVE-2026-18473 | WP Directory Kit [wpdirectorykit] < 1.5.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 1.5.5 | 1.5.5 | 2026-08-03 | — |
| CVE-2026-16589 | WP Directory Kit [wpdirectorykit] < 1.5.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 1.5.5 | 1.5.5 | 2026-08-03 | — |
| CVE-2026-42672 | WP Directory Kit [wpdirectorykit] < 1.5.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.3 | < 1.5.2 | 1.5.2 | 2026-05-14 | — |
| CVE-2026-39531 | WP Directory Kit [wpdirectorykit] < 1.5.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.3 | < 1.5.1 | 1.5.1 | 2026-04-13 | — |
| CVE-2026-39534 | WP Directory Kit [wpdirectorykit] < 1.5.1 | Missing Authorization | High 7.5 | < 1.5.1 | 1.5.1 | 2026-04-08 | — |
| CVE-2025-13920 | WP Directory Kit [wpdirectorykit] < 1.5.0 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 1.5.0 | 1.5.0 | 2026-01-23 | — |
| CVE-2025-13089 | WP Directory Kit [wpdirectorykit] < 1.4.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 1.4.8 | 1.4.8 | 2025-12-12 | — |
| CVE-2025-13390 | WP Directory Kit [wpdirectorykit] < 1.4.5 | Incorrect Implementation of Authentication Algorithm | Critical 9.8 | < 1.4.5 | 1.4.5 | 2025-12-03 | — |
| CVE-2025-13090 | WP Directory Kit [wpdirectorykit] < 1.4.7 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 4.9 | < 1.4.7 | 1.4.7 | 2025-12-01 | — |
| CVE-2025-13525 | WP Directory Kit [wpdirectorykit] < 1.4.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.4.6 | 1.4.6 | 2025-11-26 | — |
| CVE-2025-13138 | WP Directory Kit [wpdirectorykit] < 1.4.4 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 1.4.4 | 1.4.4 | 2025-11-20 | — |
| CVE-2024-37487 | WP Directory Kit [wpdirectorykit] < 1.3.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.3.6 | 1.3.6 | 2024-07-04 | — |
| CVE-2024-37253 | WP Directory Kit [wpdirectorykit] < 1.3.7 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Low 2.7 | < 1.3.7 | 1.3.7 | 2024-06-26 | — |
| CVE-2024-3217 | WP Directory Kit [wpdirectorykit] < 1.3.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.8 | < 1.3.1 | 1.3.1 | 2024-04-04 | — |
| CVE-2024-29774 | WP Directory Kit [wpdirectorykit] < 1.3.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 1.3.0 | 1.3.0 | 2024-03-25 | — |
| CVE-2023-41875 | WP Directory Kit [wpdirectorykit] < 1.2.7 | Missing Authorization | Medium 5.3 | < 1.2.7 | 1.2.7 | 2023-09-05 | — |
| CVE-2023-2351 | WP Directory Kit [wpdirectorykit] < 1.2.4 | Missing Authorization | Medium 4.3 | < 1.2.4 | 1.2.4 | 2023-06-12 | — |
| CVE-2023-2835 | WP Directory Kit [wpdirectorykit] < 1.2.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.2.4 | 1.2.4 | 2023-06-01 | — |
| CVE-2023-2278 | WP Directory Kit [wpdirectorykit] < 1.2.4 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Critical 9.8 | < 1.2.4 | 1.2.4 | 2023-05-26 | — |
| CVE-2023-2280 | WP Directory Kit [wpdirectorykit] < 1.2.3 | Missing Authorization | Medium 5.3 | < 1.2.3 | 1.2.3 | 2023-05-02 | — |
| CVE-2023-2279 | WP Directory Kit [wpdirectorykit] < 1.2.2 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 1.2.2 | 1.2.2 | 2023-04-28 | — |
| CVE-2023-2277 | WP Directory Kit [wpdirectorykit] < 1.2.2 | Cross-Site Request Forgery (CSRF) | Medium 4.7 | < 1.2.2 | 1.2.2 | 2023-04-28 | — |
| CVE-2023-31229 | WP Directory Kit [wpdirectorykit] < 1.2.0 | URL Redirection to Untrusted Site ('Open Redirect') | Medium 4.7 | < 1.2.0 | 1.2.0 | 2023-04-27 | — |
| — | WP Directory Kit [wpdirectorykit] < 1.4.1 | Missing Authorization | Medium 5.3 | < 1.4.1 | 1.4.1 | 0000-00-00 | — |
| CVE-2025-60120 | WP Directory Kit < 1.4.1 - Missing Authorization | — | Unknown | < 1.4.1 | 1.4.1 | — | — |
| CVE-2026-16593 | WP Directory Kit < 1.5.9 - Editor+ SQL Injection via Elementor Category and Location Widget Settings | — | Unknown | < 1.5.9 | 1.5.9 | — | — |
| CVE-2026-16592 | WP Directory Kit < 1.6.1 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes | — | Unknown | < 1.6.1 | 1.6.1 | — | — |
| CVE-2026-18232 | WP Directory Kit < 1.6.1 - Unauthenticated Unpublished Listing Disclosure via search_suggestion | — | Unknown | < 1.6.1 | 1.6.1 | — | — |
| CVE-2026-118421 | WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter | — | Unknown | < 1.6.3 | 1.6.3 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.